Description

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T17:18:58.730Z",
  "pubdate": "2026-08-11T17:18:58.730Z",
  "executiveSummary": "This vulnerability is classified as a Use-After-Free (UAF) memory corruption flaw affecting the Windows DNS service.\nThe primary impact of successful exploitation is arbitrary remote code execution with the privileges of the DNS service, which typically runs under high-privileged system contexts such as NT AUTHORITY\\SYSTEM.\nThe affected product is the Windows DNS server component present across vulnerable versions of the Microsoft Windows operating system.\nThe risk implications are severe, as an unauthenticated remote attacker can compromise the integrity, confidentiality, and availability of the affected host and potentially traverse interconnected network domains.\nAttacker capabilities include network-based exploitation requiring no prior authentication, user interaction, or valid credentials.\nExploitation requirements involve sending maliciously crafted network packets to the vulnerable Windows DNS service, triggering improper memory management and dangling pointer dereference conditions.",
  "technicalDetails": "The root cause of the vulnerability stems from improper memory management within the Windows DNS service when handling specific incoming DNS queries or update requests. Specifically, a dynamic memory buffer or object is allocated on the heap, and a reference to this memory is maintained across asynchronous operations. When an error condition or specific packet sequence occurs, the memory block is prematurely freed via heap management APIs, but internal data structures or execution threads retain a dangling pointer to the deallocated memory location.\nThe vulnerable component resides within the packet processing routines of the Windows DNS service binary responsible for parsing network protocol data. Because the affected versions fail to nullify pointers after heap deallocation, subsequent operations attempt to access or modify the object residing at the freed memory address.\nThe attack flow begins with an unauthorized network attacker transmitting a specially crafted sequence of DNS packets to the target server listening on standard DNS ports over UDP or TCP. Upon receipt, the Windows DNS service parses the malicious payload, triggering the flawed memory handling path. The attacker interacts with the heap layout by orchestrating heap spraying or grooming techniques prior to or during the attack, ensuring that the previously freed memory block is reallocated with attacker-controlled data, such as shellcode pointers or fake object vtables.\nWhen the service subsequently dereferences the dangling pointer, execution flow is redirected to the attacker's controlled payload. Due to the network exposure and lack of authentication requirements, the attack vector is fully remote and can be automated via network worms or custom exploit scripts.\nThe post-exploitation impact includes full system compromise. Because the Windows DNS service operates with elevated system privileges, successful code execution allows the attacker to install malware, create backdoor accounts, pivot to other internal network segments, or manipulate authoritative DNS records to facilitate man-in-the-middle attacks and credential harvesting."
}